OrbitalHealth is rolling out SageMaker Studio to 400 analysts across multiple business units. They want centralized identity management, single sign-on, and integration with the company's existing corporate identity provider for onboarding and offboarding. Which Studio Domain authentication mode should they choose and why?

IAM Identity Center (formerly AWS SSO) is the correct choice because it directly addresses all requirements: centralized identity management, single sign-on (SSO), and integration with existing corporate identity providers. This allows users to sign in with their familiar corporate credentials. IAM authentication would require creating and managing 400 individual IAM users, which is not scalable or efficient for SSO with an external IdP. While Amazon Cognito can federate with corporate identity providers, IAM Identity Center is AWS's native solution for centralized access to multiple AWS accounts and applications, making it a more integrated and simpler approach for SageMaker Studio. A service-managed identity store does not integrate with corporate identity providers and would require analysts to create new AWS accounts, which is not the desired outcome.